CVE-2026-61430: PraisonAI before 1.6.78 DNS Rebinding SSRF via web_crawl

Severity: high (CVSS 8.5 v3.1)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.3% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-07-15 · updated 2026-10-24
Weakness: CWE-918

Description

PraisonAI before 1.6.78 contains a server-side request forgery vulnerability in the web_crawl tool that validates hostnames at check time but re-resolves them at connection time without IP pinning. Attackers can use DNS rebinding to bypass SSRF protection and retrieve internal HTTP response bodies from private or loopback services.

Affected products

MervinPraison PraisonAI: before 1.6.78 — fixed in 1.6.78

How to fix

Upgrade to a fixed version: MervinPraison PraisonAI 1.6.78. Check the vendor advisory for mitigations.

References

https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg
https://www.vulncheck.com/advisories/praisonai-before-dns-rebinding-ssrf-via-web-crawl
https://github.com/MervinPraison/PraisonAI/security/advisories/GHSA-qg25-6gc4-48mg

Get alerted when CVE-2026-61430 or the next vulnerability affects your stack